Which display filter shows only packets with IP address 1.1.1.1?

• A. ip.addr == 1.1.1.1
• B. ip.addr = 1.1.1.1
• C. ip.addr equals 1.1.1.1
• D. ip.address == 1.1.1.1

Answer: (A)

In display filters, you filter by field, operator, and value. The field ip.addr refers to the IP address involved in a packet, whether it’s the source or destination. Using the equality operator with two equals signs is the correct way to match exactly, so ip.addr == 1.1.1.1 selects every packet where either the source or destination IP is 1.1.1.1.

The other forms aren’t valid: using a single equals sign (ip.addr = 1.1.1.1) isn’t the correct syntax for equality in display filters, and writing ip.addr equals 1.1.1.1 uses a keyword that isn’t recognized. Also, ip.address isn’t a valid field name here; the proper field for this purpose is ip.addr.

If you needed more precision, you could target only the source or only the destination with ip.src == 1.1.1.1 or ip.dst == 1.1.1.1.